The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements a 'State-Source Ladder' that ingests data from multiple external sources, including local artifact files, session memory, and git repository metadata. This content is processed and interpolated into agent prompts to define the 'Next Step' for the session.
Ingestion points: The skill reads state from .agents/artifacts/HANDOFF.md, project context files, and repository history via git commands.
Boundary markers: The skill explicitly enforces directory boundary checks (e.g., matching the current working directory) to prevent context bleed between projects, but it does not specify content-level delimiters or 'ignore' instructions for the data it summarizes.
Capability inventory: The skill is configured to use bash, view_file, and write_to_file tools, providing the agent with the ability to execute shell commands and modify the filesystem based on the summarized context.
Sanitization: There is no documentation of filtering or escaping for content retrieved from external sources, such as git commit messages, which could contain malicious instructions designed to influence the agent's behavior during resumption.
[COMMAND_EXECUTION]: The skill uses the bash tool to perform 'git forensics' when no other state source is available. It executes commands including git status -sb, git log --oneline -5, and ls .agents/artifacts/. While these commands are targeted at metadata retrieval, they represent a standard command execution surface that could be manipulated if the agent is influenced by injected instructions.

handoff